Thanks for the response.
It's confusing that the official advisory points to a version that doesn't exist yet[1] I get that this might be the standard process, but in practice it causes real problems as scanners pick up these recommendations and suggest upgrade paths that aren't actually available. It would be great to be upfront about this: if there's no fix yet, just say so. Pointing users to a non-existent version creates confusion and doesn't help anyone [1] https://shiro.apache.org/security-reports.html#cve_2026_48589 ---- On Sat, 06 Jun 2026 23:25:20 -0400 [email protected] wrote ---- Hi, Yeikel, As you have guessed, the CVE is referencing a new version that is still pending a release. On Jun 6, 2026, at 3:54 PM, Yeikel Santana < mailto:[email protected] > wrote: Hi all, Apologies if this has already been discussed, but I'm a bit confused about CVE-2026-48589: https://nvd.nist.gov/vuln/detail/CVE-2026-48589 The advisory appears to reference a version 2.2.1, but I haven't been able to find that version in Maven Central or any other package registry. From the GitHub releases and repository activity, it looks like 2.2.0 is still the latest released version. Am I missing something, or is the CVE referencing a version that is pending? Thanks
